nix2container

such as Bazel or Guix. I'm the nix2container author and i will be glad to discuss with you if you think this Skopeo transport could be useful for you! (btw, your blog post is pretty well written!)

be near instantaneous. Your sense of "packaging" conflates two different things. One aspect of packaging is specifying dependencies and how software gets built in the first place in a very general way. This is the hard part of packaging for cohesive software distributions such as have package managers. (This is generally not really done on platforms like Windows, at least not in a unified or easily interrogable format.) This is what an RPM spec does, what the definition of a Nix package does, etc. The other part is getting built artifacts, in whatever format you have them, into a deployable format. I would call this something like "packing" (like packing an archive) rather than "packaging" (which involves writing some kind of code specifying dependencies and build steps). If you've done the first step well— by, for instance, writing and building a Nix package— the second step is indeed trivial and "damn near instantaneous". This is true whether you're deploying with `nix-copy-closure`/`nix copy`, which literally just copy files[1][2], or creating a Docker image, where you can just stream the same files to an archive in seconds[3]. And the same packaging model which enables hermetic deployments, like Docker but without requiring the use of containers at all, does still allow keeping only a single copy of common dependencies and patching them in place.[4] -- 1: https://nix.dev/manual/nix/2.30/command-ref/nix-copy-closure... 2: https://nix.dev/manual/nix/2.30/command-ref/new-cli/nix3-cop... 3: https://github.com/nlewo/nix2container 4: https://guix.gnu.org/blog/2020/grafts-continued/

ls build a script to actually push the image by using existing store paths (which are Nix runtime dependencies of this script). Regarding the nix2container implementation, it builds a JSON file describing the Nix store paths for all layers and uses Skopeo to push the image (to a Docker deamon, a registry, podman, ...), by consuming this JSON file. (disclaimer: i'm the nix2container author) [1] https://github.com/nlewo/nix2container

ve found Yarn 4 (currently release candidate, not stable yet) in combination with https://github.com/madjam002/yarnpnp2nix to work best for this. Unfortunately we have to patch some package hashes of packages that contain platform-specific binaries (such as esbuild). - Container images are built with https://github.com/nlewo/nix2container instead of Nix's built-in docker tools, because nix2container allows configuration of layers and thus makes it easier to share layers between images and improve layer caching. As for integrating it into our CI pipeline, this is pretty much CI system agnostic as all you have to do is run `nix build ...` inside the pipeline, generating a `result` directory or file as an artifact that, in the case of nix2container, can be pushed to your container image registry.

t almost all of your requirements ("composability", reproducibility, isolation) and maybe provide better performances because it is able to split your application into several layers [2][3]. Note i'm pretty sure a lot of Docker CI also allows to efficiently build Docker images. [1] https://hercules-ci.com/ [2] https://grahamc.com/blog/nix-and-layered-docker-images [3] https://github.com/nlewo/nix2container/blob/85670cab354f7df6...